{"record":{"id":"a9e6b11e9ff2d412","repo":"paperclipai/paperclip","slug":"deletion-requires-confirm-secretid-matching-th","errorCode":null,"errorMessage":"Deletion requires --confirm <secretId> matching the secret ID.","messagePattern":"Deletion requires --confirm <secretId> matching the secret ID\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"cli/src/commands/client/secrets.ts","lineNumber":545,"sourceCode":"          printOutput(await ctx.api.get(apiPath`/api/secrets/${secretId}/access-events`), { json: ctx.json });\n        } catch (err) {\n          handleCommandError(err);\n        }\n      }),\n  );\n\n  addCommonClientOptions(\n    secrets\n      .command(\"delete\")\n      .description(\"Delete a secret\")\n      .argument(\"<secretId>\", \"Secret ID\")\n      .option(\"--yes\", \"Required safety flag to confirm destructive action\", false)\n      .option(\"--confirm <secretId>\", \"Repeat the secret ID to confirm deletion\")\n      .action(async (secretId: string, opts: SecretDeleteOptions) => {\n        try {\n          if (!opts.yes) throw new Error(\"Deletion requires --yes.\");\n          if (opts.confirm !== secretId) {\n            throw new Error(\"Deletion requires --confirm <secretId> matching the secret ID.\");\n          }\n          const ctx = resolveCommandContext(opts);\n          printOutput(await ctx.api.delete(apiPath`/api/secrets/${secretId}`), { json: ctx.json });\n        } catch (err) {\n          handleCommandError(err);\n        }\n      }),\n  );\n\n  addCommonClientOptions(\n    secrets\n      .command(\"doctor\")\n      .description(\"Run secret provider health checks through the Paperclip API\")\n      .requiredOption(\"-C, --company-id <id>\", \"Company ID\")\n      .action(async (opts: SecretDoctorOptions) => {\n        try {\n          const ctx = resolveCommandContext(opts, { requireCompany: true });\n          const health = await ctx.api.get<SecretProviderHealthResponse>(","sourceCodeStart":527,"sourceCodeEnd":563,"githubUrl":"https://github.com/paperclipai/paperclip/blob/67001ec6eb96ae601aa27bc91d9b2415d665334a/cli/src/commands/client/secrets.ts#L527-L563","documentation":"As the second confirmation for secret deletion, the action requires `--confirm <secretId>` to equal the `<secretId>` argument exactly. A mismatch (or omission, since `--confirm` has no default) throws. This typed-confirmation pattern prevents accidental deletion of the wrong secret by forcing the operator to retype the id.","triggerScenarios":"Running `paperclipai secrets delete sec_A --yes --confirm sec_B`; omitting `--confirm` entirely; a trailing/leading space or wrong-case value in `--confirm`.","commonSituations":"Copy-pasting a different secret id into `--confirm`; scripting that interpolates the wrong variable; case mismatch if ids are case-sensitive.","solutions":["Repeat the exact same secret id in both positions: `secrets delete <id> --yes --confirm <id>`","In scripts, use a single variable for both the argument and `--confirm`: `secrets delete \"$SID\" --yes --confirm \"$SID\"`","Double-check there are no extra spaces or quotes around the value"],"exampleFix":"# before\npaperclipai secrets delete sec_01H --yes --confirm sec_02H\n# after\npaperclipai secrets delete sec_01H --yes --confirm sec_01H","handlingStrategy":"validation","validationCode":"function confirmMatches(secretId: string, confirm: string | undefined): boolean {\n  return confirm === secretId;\n}\nif (!confirmMatches(secretId, opts.confirm)) {\n  throw new Error(`--confirm must equal the secret id '${secretId}'`);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use the same variable for the positional id and --confirm","Avoid copying a different id into --confirm","Trim stray whitespace/quotes around the id in both positions"],"tags":["cli","secrets","destructive","validation","confirmation"],"backgroundTag":null,"analyzedSha":"67001ec6eb96ae601aa27bc91d9b2415d665334a","analyzedAt":"2026-08-12T12:05:45.408Z","schemaVersion":2},"datasetVersion":"2026-08-12T18:17:37.767Z"}